For a school project I need access to LinkedIn API.
I have already created an app on LinkedIn Developers. However, when I do a GET request to https://www.linkedin.com/oauth/v2/authorization, I am not able to get an access token, and I get "you need to pass the scope"
Even though the documentation specified that the scope field is optional, I added scope=scope=r_liteprofile%20r_emailaddress%20w_member_social at the end of my request and got a "invalid scope error".
As for the redirect uri field, I am not sure what to put (can I put a random website URL?)
If someone knows the solution to that problem or know other ways to get an access token, I would be very grateful :) Thank you !
Kim
You need to provide a redirect URI in order to get a valid access token.
First step:
https://www.linkedin.com/oauth/v2/authorization?response_type=code&client_id=YOURCLIENTID&redirect_uri=https://my.webserver.com
Once you login and confirm LinkedIn will redirect you to the provided redirect URI with the code parameter. The next step is to exchange this code for an access token.
Second step:
https://www.linkedin.com/oauth/v2/accessToken?grant_type=authorization_code&code=CODE&redirect_uri=https://my.webserver.com&client_id=YOURCLIENTID&client_secret=YOURCLIENTSECRET
If everything is valid LinkedIn will again redirect to the provided redirect URI, but this time with the access token.
Hope it helps.
I am looking for help/advice on handling expired tokens (eg. user changes password) in conjunction with the realtime api. I have read the following http://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/
but it appears to require a user session. Currently the only solution I can see is detecting the OAuth error and informing the user via another means such as email that they need to go through the app authorisation process again.
you can renew the fb access token, there is the feasible solution for this, kindly have look into how-to--handle-expired-access-tokens here, you can see the answer in Solution (for all scenarios) section
Since the latest change on Facebook, regarding the appsecret_proof: https://developers.facebook.com/docs/reference/api/securing-graph-api/, we are still unable to download performance reports even after enabling/disabling features from Advanced Settings in our app, or apply the code as described in their document.
We are constantly getting this error:
{"error":{"message":"Invalid appsecret_proof provided in the API argument","type":"GraphMethodException","code":100}}
and I've open a confidential bug but no one returns to me with an answer.
I really don't know what more could we try?
The error is (based on my experience) almost certainly correct; it means you're proving an invalid appsecret_proof with your API call
Assuming you're using the standard PHP SDK without modifications, the most likely reasons for this are:
You configured the wrong app ID in the SDK code
You configured the wrong app secret in the SDK code
You're trying to use an access token from the wrong / another app
Another potential cause of the "Invalid appsecret_proof ..." error, is a user access token that is not associated with an app. If you are generating a user access token using the graph explorer, make sure to select an app from the dropdown on the top right corner. Otherwise, you will be generating tokens that only work within the graph API explorer.
I filed a bug with the Python SDK before I caught my mistake. GUIs are the devil.
No bug in the latest version of the facebook PHP SDK.
You need to create appsecret_proof as per the docs:
$appsecret_proof= hash_hmac('sha256', $access_token, $app_secret);
then pass it as a parameter to your api call.
See the docs here: https://developers.facebook.com/docs/graph-api/securing-requests/
Once I did this all was good and I didn't have to hack base_facebook.php
There is a bug in the Facebook SDK. After 20 hours of trying everything to debug my own code (which had no issues!), I commented this out in base_facebook.php:
/* Commented out by SJ
if (isset($params['access_token'])) {
$params['appsecret_proof'] = $this->getAppSecretProof($params['access_token']);
}
*/
And all the problems went away!
This is error is because of in correct token. It may be because you are using different account for configuring web app and mobile app for Facebook configuration. Both accounts should be same.
The app ID must be the same for your mobile app and your web app.
This error is the result of setting incorrect access token. For e.g posting to page album using a user's(admin's) access token. I have solved this error almost all the times by setting the proper access token
If this error is unexpected behavior, you may have checked a setting in your app to require it. Uncheck it and you should stop getting that error. That setting is in settings -> advanced and is called "App Secret Proof for Server API calls". Set that to NO.
As of now, that setting is on this page (make sure to put your appId in the URL): https://developers.facebook.com/apps/YOUR-APP-ID/settings/advanced/
Note this is not a universal solution, only a solution for people who don't want that behavior.
For me it was three fixes that made it work
Activate the Secret app and Access to API in the advanced configuration of your app in Facebook for developers. Although in theory it is not needed for me it always prompted that the appsecret_proof was needed even when those two options were off.
When creating the appsecret_proof, the access_token used to create it should be the same access_token to send in the request, and its the user access_token, my error was that I was using the app access_token. Use the user access_token.
Send the parameter appsecret_proof as appsecret_proof, not as app_secret_proof. A minor detail but happened to me.
Extra:
For python you can create the appsecret_proof like this:
import hmac
import hashlib
facebook_app_secret = '<your_app_secret>'
facebook_access_token = '<your_user_access_token>'
appsecret_proof = hmac.new(facebook_app_secret.encode('utf-8'),
msg=facebook_access_token.encode('utf-8'),
digestmod=hashlib.sha256).hexdigest()
print(appsecret_proof)
Gotten from facebook graph api calls with appsecret_proof in python
make sure your setting correct fbappid + fbappsecret
this error happens when those are not set correct
like you have 2 apps one development and one production
and you mess up the codes, double check those two
Just for people having the same problem;
When you set Client OAuth Login to "yes" on facebook, you should give proper Valid OAuth redirect URIs . Otherwise facebook throws exactly the same error.
In my case I needed to set Default Access Token via method: setDefaultAccessToken()
I used token generated in GraphApi dev tool but I did not switch into proper application. It was solved by changing application into proper one and using regenerated token.
I know that this is an old question but I solved mine by changing the Application to the proper application that I should be generating an access token with. E.g. from Project1 to Project2.
Perhaps something wrong with your access token, you need Business Manager style.
You can get the token from the content of https://business.facebook.com/settings/system-users/{sys_user_id}?business_id={business_id} with regex r'"accessToken":"([\d|\w]+)","context"'
Works for me:
$appsecret_proof = hash_hmac('sha256', $facebook_page_token, $app_secret);
WHERE facebook_page_token is the page token stored in my database created when I associate the page to the app.
Problem comes from wrong platform access token.
You should check your dashboard which you preferred to API and check your access token where it comes from.
when I do a get request to
https://graph.facebook.com/[userid]
with the access_token i get all the basic info
but when I do
https://graph.facebook.com/me
with the same token i get an error message: An active access token must be used to query information about the current user
I have tried to under stand what can cause that.
I even tried to token that comes with the signed request
I'm on classic asp, with JSON library, I want the auto to be server side if possible. the FB.api("/me" is working but it is not what i really want to achive
I am pretty sure you don´t have a user access token. Did you login the user? Of course you get the public data of every user with your first link, even without any access token. You can even put it directly in the browser and will get results. But for "/me" you have to authorize the user to your app.
See here: https://developers.facebook.com/docs/howtos/login/server-side-login/
It is the same problem as in the other thread for sure, just a different Programming language.
Remember: If the user did not accept at least the basic permissions in a dialog or redirect, he is not logged in and you will never know anything about him in the app (except for some specifics in tab apps, like language, like-status and stuff).
We're using the Facebook JS SDK to authenticate users to our application, then sending that information to the server back end to log our user into the application (we support multiple forms of authentication but we can only support FB using a client side flow).
FB is able to log in correctly, I'm able to authenticate the user and everything else, but there's one wrinkle that I'm not sure how to handle, and I'm having difficulty finding anything in the documentation about it. Facebook sends back an accessToken in addition to an id. My question is, how do I verify on the server side that the accessToken is correct for the given id? I want to make sure that the data the user sends us matches what Facebook sent them, and I can't imagine this is that out of the ordinary, yet I can't seem to find any documentation on it.
In the response from Facebook should be a signed_request string that can authenticate that the data is genuine with and decoded to yield the user id and an oauth token for the user.
Passing this along with the other response to your server-side code should allow you to validate everything pretty easily.
May I suggest this answer from another question! It uses try-catch. It is probably the only way to verify that the authentication and the permissions are valid! That's how they do in their examples
Facebook OAuthException: (#1)
I dont think facebook provides any other way of checking